Active Directory, Second Edition

DIT Maintenance

On a periodic basis, such as a couple of times a year, you should check the health of the DIT file (ntds.dit) on your domain controllers. Using the ntdsutil utility, you can check the integrity and semantics of the Active Directory database and reclaim whitespace, which can dramatically reduce the size of the DIT. Also, just as you should rotate the password for the Administrator accounts in the forest, you should also change the DS Restore Mode Administrator password as well. You may even need to do this more frequently depending on whether you have people leave your team that should no longer know the password.

Unfortunately, to accomplish all these tasks—except changing the DS Restore Mode Administrator password—you have to boot the domain controller into DS Restore Mode. That means you will have to have schedule downtime for the machine. Also, to use DS Restore Mode, you need console access either through being physically at the machine or with out-of-band access, such as with Compaq’s Remote Insight Lights Out Board (RILOE). There is one other option using Terminal Services. You can modify the boot.ini file on the domain controller to automatically start up in DS Restore Mode. You can then use a Terminal Services connection to log in to the machine. For more information, check out MS Knowledge Base article 256588 from http://support.microsoft.com.

Checking the Integrity of the DIT

There are several checks you can perform against the DIT file to determine whether ...